Dozens of Live Malicious Agent Skills Found Hiding in Plain Sight

Your AI agent just loaded a third-party skill. It now has your credentials, your files, and your calendar — and it follows instructions from whoever wrote that package. Researchers went looking for malicious skills in real marketplaces and found them. Not hypothetical ones. Live ones.

What happened

Researchers from the University of Luxembourg built a detector called Locate-and-Judge to scan agentic workflow skill marketplaces for malicious packages — the file-based instruction bundles that LLM agents load and execute with full user privileges. The core insight: existing prompt injection defenses assume a clean boundary between trusted instructions and untrusted data, but a skill is instructions, so injected commands inherit the same authority as legitimate ones. Locate-and-Judge works in two stages: a lightweight locator uses instruction-following attention to score structural spans within a skill and retains only the top-K candidates, then an LLM-as-judge examines only those high-attention spans in detail. The result is an order-of-magnitude cost reduction versus direct LLM scanning, at a “small cost to recall,” while dominating keyword and regex baselines at comparable expense. Deployed against live marketplaces, the system flagged skills with high precision — the majority manually confirmed as malicious — surfacing dozens of live malicious skills, including several disguised as benign functionality and many missed entirely by both SkillSpector and Cisco Skill Scanner. A labeled dataset has been released.

Cold read

“Dozens of live malicious skills” sounds alarming, but the abstract gives no absolute count, no denominator, and no false-positive rate — so “high precision” is a qualitative claim you cannot yet stress-test. The recall trade-off is acknowledged but not quantified: “small cost” is doing a lot of work when you’re talking about a security detector where every miss is a potential supply-chain compromise. The attention-based locator is elegant, but attention weights are a noisy proxy for semantic authority — a sufficiently sophisticated adversary who understands this mechanism can likely craft skills that distribute malicious instructions across low-attention spans. The evaluation is also static: it tests skills already in marketplaces, not adversarially adaptive ones written knowing this detection approach exists. Finally, the researchers built and evaluated their own detector on their own dataset, which has no independent red-team validation cited in the abstract.

What it means for you

• Signal maturity: 2/5 — proof-of-concept on real data, but no independent replication or adversarial stress test
• Who gets hurt: Any startup building on top of agent platforms that support third-party skill/plugin ecosystems (think: OpenAI GPTs, custom agent frameworks, enterprise automation tools layered on LLMs)
• What breaks if this is true: Your “no-code AI workflow” product is a distribution channel for malicious instruction packages that execute with your customers’ credentials — and your ToS won’t save you when the breach notice goes out
• Why it might not land: Marketplace operators have strong incentives to bury this; without regulatory pressure or a high-profile breach, detection tooling stays academic
• Watch for: A named enterprise breach traced to a third-party agent skill — that’s the trigger that turns this from a research paper into a procurement requirement overnight

Forecast as of 2026-06-23

By Q2 2027, at least one major agent platform (top-5 by user count) will have publicly announced a mandatory pre-publication skill scanning policy — but fewer than half will be running a mechanism meaningfully more sophisticated than keyword filtering, making the Locate-and-Judge gap commercially exploitable.

Source: Detecting Malicious Agent Skills in the Wild using Attention — Bacem Etteib, Daniele Lunghi, Tégawendé F. Bissyandé. https://arxiv.org/abs/2606.23416v1